1. Field of the Invention
This invention pertains in general to computer security and in particular to the identification of malware.
2. Description of the Related Art
There is a wide variety of malicious software (malware) that can attack modern computers. Malware threats include computer viruses, worms, Trojan horse programs, spyware, adware, crimeware, and phishing websites. Modern malware is often designed to provide financial gain to the attacker. For example, malware can surreptitiously capture important information such as logins, passwords, bank account identifiers, and credit card numbers. Similarly, the malware can provide hidden interfaces that allow the attacker to access and control the compromised computer.
Some security software functions to identify malware threats based on signatures that define information that is unique to known malware threats. Typically, a security software provider transmits a set of signatures to a client running the provider's software. The signatures are then used by the provider's security software to scan the client system for files matching the signatures. Files matching signatures are “convicted” (identified) as malware threats.
Security software may perform behavior-based identification of malware in conjunction with, or instead of, signature-based methods. In behavior-based identification of malware threats, the security software seeks to identify malware threats by monitoring behaviors or actions performed by software applications as they execute on a client system. Software applications that perform one or more behaviors or actions that are associated with a high likelihood of being performed by a malware threat are convicted.
While signature-based identification of malware and behavior-based identification of malware provide complimentary methods of identifying malware threats, these methods are complicated by the large number of new malware threats or variations of existing malware threats (i.e. polymorphic malware) that are continuously being disseminated into computing environments. This continuous introduction of new malware threats into computing environments makes the identification of a comprehensive set of malware signatures and behaviors corresponding to all malware threats unscalable. Accordingly, there is a need in the art for improved methods of identifying malware threats.